Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-116068: Dokploy lets admins control other tenants’ apps

CVE-2026-116068 · published 8 days ago

Summary

If you use Dokploy version 0.30.10 or earlier, an admin of one organization can issue commands that affect applications belonging to a different organization. This can let them change settings, secrets, or stop those apps. Upgrade Dokploy to a newer version or apply the vendor’s patch as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
dokploy	dokploy	<= 0.30.10

Original advisory text

Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.

References

https://github.com/Dokploy/dokploy Product
https://github.com/Dokploy/dokploy/blob/073713f0b863eca4285ad24db00550af1b39397a... Third Party Advisory
https://github.com/Dokploy/dokploy/blob/073713f0b863eca4285ad24db00550af1b39397a... Third Party Advisory
https://github.com/Dokploy/dokploy/issues/5635 Third Party Advisory
https://github.com/Dokploy/dokploy/commit/b3cd3c5061b9e4f9a786dc4a048765f79bae25... Patch
https://www.vulncheck.com/advisories/dokploy-through-0.30.10-cross-organization-... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-1160... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-116068 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.4 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-639Authorization Bypass Through User-Controlled Key

Timeline

Published25 Oct 2026

Updated29 Oct 2026

First seen25 Oct 2026

Sources

CVE-2026-116068 · NVD

CVE-2026-116068 · MITRE

CVE-2026-116068 · OSV

Track software like this

Free during beta